Pulse Detail — Threat Intelligence

PULSE NAME

OtterCookie: Analysis of New Lazarus Group Malware

WHITE Lazarus PetrP.73 2025-06-03 Modified: 2025-07-03

IOCs

MEDIUM VOLUME

North Korean state-sponsored cyber-attack group Lazarus is continuing to target professionals in the tech, financial and crypto sectors with a new tool called OtterCookie, an analysis shows, including fake job offers.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1003 T1071 T1082 T1571 T1560 T1095 T1496 T1027 T1106

MALWARE FAMILIES

Lazarus Exodus Wallet Beavertail OtterCookie

Indicators of Compromise (4 / 26 total)

All FileHash-MD5 FileHash-SHA256 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	071aff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9	—	2025-06-03
FileHash-SHA256	486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5386d	—	2025-06-03
FileHash-SHA256	aa0d64c39680027d56a32ffd4ceb7870b05bdd497a3a7c902f23639cb3b43ba1	—	2025-06-03
FileHash-SHA256	ec234419fc512baded05f7b29fefbf12f898a505f62c43d3481aed90fef33687	—	2025-06-03

References (1)

↗ https://any.run/cybersecurity-blog/ottercookie-malware-analysis/